coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

CCR-2026-0029/0030: activity-core ops_run worker token paths (proposed)

Browse source 
ACTIVITY-WP-0039-T02. Add read on the two exact worker-token paths to
workload-kv-read-activity-core-eso, one CCR per worker identity. Adds
scripts/openbao-policy-sync.sh, a silent attended policy writer that refuses
undeclared live drift and verifies on readback. Not applied; CCRs await
platform-operator and activity-core-owner approval.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 150322@bnt-lap001
Assistant-Session: 16a7b788-374e-4915-a1df-fc87ffd9a5e4
This commit is contained in:
codex 2026-09-23 20:00:40 +02:00
parent 915a3cacd9
commit 15184aaa01
8 changed files with 413 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

7
workplans/RPF-WP-0046-eso-database-token-renewal.md
View file

@ -10,6 +10,7 @@ topic_slug: railiance
created: "2026-09-23"
updated: "2026-09-23"
related: [RPF-WP-0045, RPF-WP-0037, RPF-WP-0036]
state_hub_workstream_id: "cdb309e0-adb4-58aa-9c98-5ea270780e8d"
---
## Problem
@ -56,6 +57,7 @@ Design:
id: RPF-WP-0046-T01
status: done
priority: high
state_hub_task_id: "25592a83-d2e5-5aa2-b23e-5d563a621f19"
```
`argocd/platform-addons/eso-token-renewer/` holds `renew.py`, the
@ -73,6 +75,7 @@ AppProject is applied by hand, so the git change alone is not live. Tests:
id: RPF-WP-0046-T02
status: done
priority: high
state_hub_task_id: "a318792f-82ba-568b-8633-fba3513aa978"
```
The script is `scripts/openbao-eso-db-token-periodic-attended.sh`. It is
@ -87,6 +90,7 @@ parity with the CronJob mounts is tested.
id: RPF-WP-0046-T03
status: wait
priority: high
state_hub_task_id: "211bc548-34af-5f3a-ab2c-bf29d33f97ad"
```
This step is `ADMINISTER @ realm:kubernetes/railiance01`, `activation=APPROVED`,
@ -109,6 +113,7 @@ ExternalSecrets are `SecretSynced`.
id: RPF-WP-0046-T04
status: wait
priority: high
state_hub_task_id: "28726b1b-3777-5945-859b-9e563b12fee6"
```
1. Apply `argocd/railiance01/bootstrap/02-railiance-platform-addons-project.yaml`
@ -125,6 +130,7 @@ priority: high
id: RPF-WP-0046-T05
status: wait
priority: high
state_hub_task_id: "acf49bee-e40a-533c-b1f0-4152c989211d"
```
The replaced 768h tokens still expire around 2026-10-25T17:00Z, and they
@ -144,6 +150,7 @@ ready.
id: RPF-WP-0046-T06
status: todo
priority: medium
state_hub_task_id: "2f528e56-ebf0-547e-8d4f-3cb34c348d46"
```
- rapp-postgres: the 768h mint scripts (`apply-*-eso-token*.sh`) would undo